Welcome to the most active Linux Forum on the web.
Go Back > Forums > Non-*NIX Forums > Programming
User Name
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.


  Search this Thread
Old 06-21-2007, 03:57 AM   #1
LQ Addict
Registered: Jul 2003
Location: London, UK
Distribution: Slackware
Posts: 7,464

Rep: Reputation: Disabled
Incorrect source/destination ports when reading tcpdump data with libpcap

I have a binary tcpdump file that I'm reading with libpcap, so I can get IP addresses, ports and timestamps out and then eventually put them in a database. I also have an ASCII version of this tcpdump file (which was generated by reading the binary file with tcpdump and then just redirecting the output) and I'm using this to compare the output of my program. My program outputs the source and destination IP addresses correctly, but not the source and destination ports, so I must be doing something wrong. Relevant code is as follows:

pcap_t *handle = pcap_open_offline(file, error_buffer);
struct pcap_pkthdr *packet_header;
const u_char *packet;
struct ip *ip_packet;
struct tcphdr *tcp_segment;

// Get one packet
packet = pcap_next(handle, packet_header);
ip_packet = (struct ip*)(packet + sizeof(struct ether_header));
tcp_segment = (struct tcphdr*)(packet + sizeof(struct ether_header) 
			     + sizeof(struct ip));
cout << "Source port: " << tcp_segment->source << endl;
cout << "Destination port: " << tcp_segment->dest << endl;
For the first packet in my input data, my program gives the following output:

Source port: 384
Destination port: 20480

The output from my program is the same if I have "#define __FAVOR_BSD" in my code and use the other tcphdr struct defined in <netinet/tcp.h>. My ASCII log file gives the source and destination ports as 32769 and 80 (well, http), respectively.

Any ideas? Thanks.
Old 06-21-2007, 04:06 AM   #2
Registered: Sep 2006
Location: Munich, Germany
Distribution: Debian / Ubuntu
Posts: 297

Rep: Reputation: 49
Seems like you have to reverse the byte order using ntohs().
Old 06-21-2007, 04:10 AM   #3
LQ Addict
Registered: Jul 2003
Location: London, UK
Distribution: Slackware
Posts: 7,464

Original Poster
Rep: Reputation: Disabled
Genius! Thanks very much .


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
source code for reading data through com port rs232 applee Programming 2 03-03-2007 07:55 AM
ifconfig ppp0 reading incorrect colabus Debian 1 02-20-2005 03:47 PM
what is the method of reading the data in a packet using Libpcap gajaykrishnan Linux - Networking 0 02-20-2005 02:29 AM
Incorrect destination addy on subnet traffic af_dave Linux - Security 5 08-29-2004 02:43 AM
Help reading TCPDUMP output BenCarlisle Linux - Networking 3 02-27-2003 02:35 PM > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 12:00 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration